From Adversarial Poetry to Adversarial Tales: An Interpretability Research Agenda

TL;DR

This paper expands the landscape of jailbreaking byIntroducing Adversarial Tales, a structurally grounded jailbreak that embeds harmful content within cyberpunk narratives and prompts models to perform Proppian functional analysis. Across 26 frontier models, the attacks achieve an average attack success rate of 71.3%, indicating a broad vulnerability to structurally mediated prompts that generalize across providers and architectures. The work argues that purely surface-level defenses are insufficient, framing a mechanistic interpretability research agenda to uncover how narrative cues reshape representations and how to detect harmful intent beyond surface form. By linking Adversarial Tales with Adversarial Poetry, it presents a unified vision of a systemic class of jailbreaks and highlights the need for cross-model defenses that target internal representations and attention dynamics. The proposed defenses emphasize analyzing internal mechanisms, particularly attention patterns, and exploring the universal weight subspace to guide transferable anti-jailbreaking strategies.

Abstract

Safety mechanisms in LLMs remain vulnerable to attacks that reframe harmful requests through culturally coded structures. We introduce Adversarial Tales, a jailbreak technique that embeds harmful content within cyberpunk narratives and prompts models to perform functional analysis inspired by Vladimir Propp's morphology of folktales. By casting the task as structural decomposition, the attack induces models to reconstruct harmful procedures as legitimate narrative interpretation. Across 26 frontier models from nine providers, we observe an average attack success rate of 71.3%, with no model family proving reliably robust. Together with our prior work on Adversarial Poetry, these findings suggest that structurally-grounded jailbreaks constitute a broad vulnerability class rather than isolated techniques. The space of culturally coded frames that can mediate harmful intent is vast, likely inexhaustible by pattern-matching defenses alone. Understanding why these attacks succeed is therefore essential: we outline a mechanistic interpretability research agenda to investigate how narrative cues reshape model representations and whether models can learn to recognize harmful intent independently of surface form.